.gif)
We build custom applications 5x faster and cheaper 🚀
Book a Free Consultation
Stuck on an error? Book a 30-minute call with an engineer and get a direct fix + next steps. No pressure, no commitment.
To integrate Replit with Nexmo (now Vonage API), you create a Node.js or Python Repl, install the official Vonage SDK, securely store your API credentials in Replit Secrets, and use standard HTTPS routes to send or receive messages (SMS) or handle incoming webhooks. You expose your Replit web server via the port bound to 0.0.0.0 and Replit provides a public URL for incoming events like delivery receipts or inbound messages. Nothing automatic happens — you explicitly configure API keys, webhook URLs, and endpoints in your Vonage Dashboard. Once running, your Repl can send SMS, make voice calls, or respond to webhooks in real-time while it’s active.
1. Create your Repl and set up environment:
.png)
.png)
# Installing the official Vonage Node.js SDK
npm install @vonage/server-sdk express body-parser
2. Create your server and configure Vonage client:
// index.js
import express from "express"
import bodyParser from "body-parser"
import { Vonage } from "@vonage/server-sdk"
const app = express()
app.use(bodyParser.json())
// Initialize Vonage client using secrets
const vonage = new Vonage({
apiKey: process.env.VONAGE_API_KEY,
apiSecret: process.env.VONAGE_API_SECRET
})
// Example route to send an SMS
app.get("/send-sms", async (req, res) => {
try {
const response = await vonage.sms.send({
to: "DESTINATION_PHONE_NUMBER", // e.g. "14155550123"
from: "VonageAPI",
text: "Hello from Replit + Vonage integration!"
})
res.json(response)
} catch (err) {
console.error(err)
res.status(500).json({ error: err.message })
}
})
// Webhook route to receive inbound SMS or delivery receipts
app.post("/webhooks/inbound-sms", (req, res) => {
console.log("Inbound SMS:", req.body)
res.status(200).end() // Always respond 200 OK
})
// Express listens on Replit’s required host/port
app.listen(3000, "0.0.0.0", () => console.log("Server running on port 3000"))
3. Run the Repl: Replit gives you a public URL like https://your-repl-name.username.repl.co. Copy it.
https://your-repl-name.username.repl.co/webhooks/inbound-smsNow whenever an SMS is sent to your Vonage number, Vonage will POST data to that endpoint, and you’ll see it logged in the Replit console.
In this setup, Replit hosts the logic, while Vonage handles telecom infrastructure. When you call the SDK’s send method, your Repl’s server makes a secure HTTPS request to Vonage’s API servers. For webhooks, Vonage’s servers send HTTP POST requests back to your Repl’s public URL. Replit automatically forwards those requests to your Express app.
You now have a fully working, real-world Replit + Nexmo (Vonage) integration: explicit API usage, portable, and secure. Nothing magical — just correct plumbing between Replit’s hosted runtime and Vonage’s REST infrastructure.
1
Use Replit to host a small backend that sends real-time SMS notifications through Nexmo (Vonage API) when specific actions occur in your web app — like a new user registration or form submission. You store your API_KEY and API_SECRET in Replit Secrets, and trigger the message via a REST API route in your Repl. The code runs inside a Node.js server bound to 0.0.0.0 and exposed through Replit’s mapped port, accessible by a frontend or another service.
// Example: sending an SMS using Vonage in Replit
import express from "express"
import Vonage from "@vonage/server-sdk"
const app = express()
const vonage = new Vonage({
apiKey: process.env.VONAGE_API_KEY,
apiSecret: process.env.VONAGE_API_SECRET
})
app.get("/notify", async (req, res) => {
await vonage.sms.send({to: "14155550123", from: "ReplitDemo", text: "New signup!"})
res.send("SMS sent")
})
app.listen(3000, "0.0.0.0")
2
Implement a secure 2FA verification flow inside Replit using the Nexmo Verify API. When a user logs in, your backend calls Vonage to send a one-time verification code via SMS. The user inputs the code on your web interface; your backend verifies it against Vonage’s API. This strengthens security for small projects or internal tools deployed through Replit, without building custom verification logic.
// Sending and checking 2FA code
app.get("/start-verify", async (req, res) => {
const response = await vonage.verify.start({number: "14155550123", brand: "Replit2FA"})
res.json(response)
})
app.get("/check-verify", async (req, res) => {
const code = req.query.code
const requestId = req.query.request_id
const response = await vonage.verify.check(requestId, code)
res.json(response)
})
3
When Vonage sends webhooks about incoming messages or call events, your Replit server can receive and log them live. You run an Express server that listens on a specific Replit URL, which you register in your Vonage account as the webhook callback. Testing webhooks works well with active Repls because they have public URLs and stay alive while you debug response payloads in real time.
// Receive Vonage inbound SMS webhook
app.post("/webhooks/inbound-sms", express.urlencoded({extended: true}), (req, res) => {
console.log("Inbound SMS:", req.body)
res.status(200).end()
})
// Test live events via the public Replit URL
Speak one‑on‑one with a senior engineer about your no‑code app, migration goals, and budget. In just half an hour you’ll leave with clear, actionable next steps—no strings attached.
1
If your Nexmo (Vonage) API key isn’t loading from Replit Secrets, confirm that the secret name matches exactly the variable used in your code, that it’s properly set in the Replit Secrets panel, and that the service is reading it at runtime (not hardcoded). In Replit, secrets are injected as environment variables only when the Repl runs — they’re not available during “static” build or config steps.
// Example in Node.js using Vonage SDK
import Vonage from '@vonage/server-sdk'
const vonage = new Vonage({
apiKey: process.env.NEXMO_API_KEY, // must match your secret name
apiSecret: process.env.NEXMO_API_SECRET
})
// Check if loaded correctly
if (!process.env.NEXMO_API_KEY) console.error("NEXMO_API_KEY missing!")
Replit restarts reset ephemeral filesystem but secrets persist permanently in the Secrets manager. If it still fails, verify you didn’t add the secret under Deployments or another project — each Repl keeps its own secret set.
2
A 401 Unauthorized error from an SMS API call in a Replit project usually means your HTTP request didn’t include valid authentication credentials — or that those credentials weren’t transmitted correctly from your Replit Secrets environment variables. This happens when the API key, token, or Basic Auth header is missing, misspelled, expired, or not properly loaded at runtime inside the Repl.
API_KEY vs api_key.Authorization header. Ensure your code sends it correctly.process.env in Node, not hardcoded strings, since Replit restarts clear non-persistent state.
// Node.js example for Twilio-like API
import fetch from "node-fetch"
const apiKey = process.env.API_KEY // stored in Replit Secrets
const apiUrl = "https://sms-provider.com/api/send"
const res = await fetch(apiUrl, {
method: "POST",
headers: {
"Content-Type": "application/json",
"Authorization": `Bearer ${apiKey}` // must match provider’s requirement
},
body: JSON.stringify({ to: "+15551234567", text: "Hello!" })
})
console.log(await res.text()) // should not be 401 now if credentials are valid
3
Replit sometimes blocks outgoing HTTPS calls when network config or secrets are misused. To enable Vonage API requests, ensure your Repl runs with internet access (not Deployment-only mode) and that you imported proper HTTPS libraries. Test the outbound connection directly, verify your API keys are set as Replit Secrets, and check if logs show SSL or DNS errors — these indicate configuration or certificate problems, not Replit blocking.
// Example test inside Repl
import axios from "axios"
const testVonage = async () => {
try {
const res = await axios.get("https://api.vonage.com/account", {
auth: {
username: process.env.VONAGE_API_KEY,
password: process.env.VONAGE_API_SECRET
}
})
console.log(res.data)
} catch (err) {
console.error(err.message)
}
}
testVonage()
If HTTPS requests still fail, confirm your Repl isn’t paused or rate-limited, and that outbound ports (443) are allowed. No extra activation is needed; correct code and live runtime make Vonage HTTPS requests work.
Vonage (formerly Nexmo) APIs require API_KEY and API_SECRET. Many users accidentally hardcode credentials or forget to add them to Replit Secrets. In Replit, secrets are accessed from environment variables, not from files or global configs. Missing or empty secrets lead to 401 “Unauthorized” errors from Vonage. Always create them under Tools → Secrets and fetch them using process.env within your code.
echo $VONAGE_API_KEY.// Correct usage of secrets in Node.js app
import Vonage from '@vonage/server-sdk'
const vonage = new Vonage({
apiKey: process.env.VONAGE_API_KEY,
apiSecret: process.env.VONAGE_API_SECRET
})
Replit requires any web or webhook server to bind to 0.0.0.0, not localhost. If you bind incorrectly, Vonage can’t send you incoming webhook requests (for message status, inbound SMS, or voice events), because those need to reach your public Repl URL. This causes “connection refused” or timeout errors and makes debugging hard since no request ever reaches your code.
// Correct server binding for Replit webhook listener
import express from 'express'
const app = express()
app.use(express.json())
app.listen(3000, '0.0.0.0', () => console.log('Server running'))
When configuring webhooks in the Vonage dashboard or API setup, many forget to point URLs to the public Replit URL (e.g. https://your-repl-name.username.repl.co/event). Using “localhost” or an outdated Repl URL means Vonage can’t deliver events. Each Repl instance may change its URL after a fork or rename, and you must update it manually in your Vonage app setup.
/inbound-sms).// Example endpoint to receive incoming SMS
app.post('/inbound-sms', (req, res) => {
console.log(req.body) // View payload sent by Vonage
res.status(200).end()
})
Vonage can include a signature parameter to help you verify webhook authenticity. Many ignore it, allowing fake requests to affect your logic. On Replit, this verification must happen inside your listener before trusting request data. Use the shared signature secret in Replit Secrets, compute the expected hash, and compare it before processing. This keeps your integration secure and production-safe.
// Example of webhook signature verification
import crypto from 'crypto'
const expected = crypto.createHmac('sha256', process.env.VONAGE_SIGNATURE_SECRET)
.update(JSON.stringify(req.body))
.digest('hex')
if (req.query.sig !== expected) return res.status(403).end()
This prompt helps an AI assistant understand your setup and guide you through the fix step by step, without assuming technical knowledge.
From startups to enterprises and everything in between, see for yourself our incredible impact.
They do complex work on extremely fast timelines and effectively manage the testing and pre-launch process to deliver the best possible product. I'm extremely impressed with their execution ability.
